Docs / API Reference / Authentication

Authentication

Every LocalLeads API request must include a valid API key. Keys are passed as a Bearer token in the Authorization header — no sessions, cookies, or OAuth flows required.

Getting an API Key

  1. Open Settings → Security → API Keys.
  2. Click New key, give it a name, and set an optional expiry.
  3. Copy the full key — it is shown once only.
  4. Store it in an environment variable, not in source code.
API keys carry your full account permissions. Treat them like passwords. Never commit them to source control or expose them in client-side code. Revoke compromised keys immediately from the dashboard.

Key Format

All API keys start with the prefix ll_ followed by 64 lowercase hex characters (256 bits of entropy). Example:

ll_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2

The dashboard shows the first 12 characters as a visual identifier (ll_a1b2c3d4e5…). The full key is never stored server-side — only its SHA-256 hash is kept.

Using the Key in Requests

Pass the key in the Authorization header on every request:

http
Authorization: Bearer ll_your_api_key_here
curl
curl https://leadsapi.postorbit.io/api/v1/credits/balance \
  -H "Authorization: Bearer $LOCALLEADS_API_KEY"
Store your key in an environment variable (e.g. LOCALLEADS_API_KEY) and read it at runtime. Never interpolate it directly into code that ships to version control.

Auth Errors

An unauthenticated or invalid request returns 401 Unauthorized:

json
{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Invalid or expired token"
}

Common causes:

  • The Authorization header is missing entirely.
  • The key has been revoked from the dashboard.
  • The key has passed its optional expiry date.
  • The key was typed incorrectly — check for extra whitespace.

Key Expiry

Keys can be created with an optional expiry date. Once expired, they return 401 immediately. Non-expiring keys remain valid until explicitly revoked. The expiry date appears in the key list in the dashboard.

Each organisation can have up to 10 active API keys at once. See the API Keys section to manage keys programmatically.
←Getting StartedLeads→